Is there a way to desactivate temporarily an issue ?

[enzo-dechaene]

Hi @pmckeown,

I'm looking to use the maven dependency track plugin but I'm wondering how to temporarily disable a critical issue?
I'm going to use the findings command and if I can't disable an issue, it will be blocked every time I want to build it.

[pmckeown]

The docs tell you how to set up the findings thresholds to avoid this situation. If you don't specify thresholds, then the findings goal shouldn't fail.

https://github.com/pmckeown/dependency-track-maven-plugin?tab=readme-ov-file#get-project-findings

[enzo-dechaene]

Yes, I can configure result thresholds, but I want to ignore a specific CVE. Can I do this with your plugin?

I'd like to specify a file containing the list of CVEs to be ignored when obtaining results.

<?xml version="1.0" encoding="UTF-8"?>
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
    <suppress>
        <notes>spring-web-5.3.24.jar</notes>
        <packageUrl regex="true">^pkg:maven/org\.springframework/spring\-web@.*$</packageUrl>
        <cve>CVE-2016-1000027</cve>
    </suppress>
</suppressions>

[pmckeown]

Sorry, there is no way with the plugin to handle auditing of CVEs in the platform. It just covers the use cases for build time integration for fast feedback on the presence of issues. The intent was that any triaging/auditing would be done in the GUI.